In what would be its third major action against Meta since 2012, the FTC has proposed several new, significant changes to its 2020 Privacy Order (“2020 Order”) with Meta after alleging unsatisfactory compliance. The proposal would severely limit Meta’s use of data collected from users under 18 and delay its ability to launch new products and services. The FTC has formally asked Meta to respond, and Meta publicly stated it will vigorously fight the agency’s action.
FTC’s Allegations Against Facebook
Following a review of Meta’s practices, the FTC contends that Meta has failed to fully comply with the 2020 Order because its privacy program has “gaps and weaknesses of varying significance” and because the company has made several misrepresentations to users.
Specifically, the FTC claims that Meta misled parents about their ability to control who their children communicated with through the Messenger Kids app because coding errors enabled children, in certain circumstances, to communicate with unapproved contacts in group text chats and group video calls. According to the Commission, this violates the Children’s Online Privacy Protection Act and its corresponding rule (“COPPA”) because Meta’s conduct was “in contravention of [Facebook’s] representations and notice to parents.”
The Agency’s Order to Show Cause also alleges that Meta misrepresented the access it provided some Facebook app developers to private user data. In particular, in 2018, Meta promised to cut off access if users had not used those apps in the previous 90 days, but Meta purportedly continued to allow third-party app developers to access that user data until mid-2020.
In response, Meta has stated that it quickly identified and fixed the coding errors that the FTC noted, and voluntarily informed both the FTC and Facebook users about such errors.
Proposed Modifications to 2020 Privacy Order
The FTC’s Proposed Decision and Order are broad and significant, and at least one FTC Commissioner (the most recently addition to the Commission) expressed concerns about the FTC’s authority to enforce the proposed changes. The proposed changes would apply to Facebook, as well as Meta’s other related entities (e.g., Instagram, WhatsApp, and Oculus) and primarily include:
- A blanket prohibition against processing data of children and teens under 18 except for limited purposes such as to provide the specific service and to comply with law. Meta cannot otherwise process or monetize such data.
- A pause on the launch of new products, services.
- An extension of compliance to merged companies.
- Limits on future uses of facial recognition technology.
- Strengthening existing requirements.
Takeaways
The FTC’s proposed revisions to the 2020 Order reflect a continued aggressiveness in the FTC’s enforcement activities and a willingness to test the bounds of its authority. As a substantive policy matter, the FTC’s action also broadcasts its continued focus on children’s privacy and a willingness to impose tight review of companies under order.
